This invention relates generally to trend performance analysis and more particularly to detecting an abnormal condition in a multi-sensor environment using a composite change score.
Trend performance analysis is typically used to monitor and analyze sensor data and derived values for a technical process. One type of technical process where trend performance analysis is used is with aircraft engines. In this example, engine data are sampled from an airplane at different times of the flight and transmitted to a ground station. The data are collected and distributed to an aircraft engine expert for that particular airplane fleet. The data are preprocessed and evaluated by a trend performance analysis tool. In particular, the trend performance analysis tool monitors a multitude of engine variables. Data for each variable are compared against trending baseline data. If the data for a particular variable exceed a predetermined threshold limit and the data are-not considered to be outliers, then the trend performance analysis tool issues an alert. Typically, the predetermined alert threshold limit for each variable is set at a level that is below a limit that would generate a fault warning flag in the cockpit of the airplane. In particular, the predetermined alert threshold limit for each variable is at a level that would create an awareness of a potential problem before it turns into an event that could result in a revenue loss for the airplane. Examples of potential revenue loss situations are a grounding of an airplane, damage to an engine, departure delay, etc.
After the trend performance analysis tool issues an alert, the aircraft engine expert examines trend charts for each of the variables in order to determine if an event has truly occurred which warrants further action. If the data in any of the trend charts are suspicious, then the aircraft engine expert notifies the fleet management of that particular airplane and suggests actions to further diagnose and/or actions to correct any causes for the alert. Examples of possible actions are boroscoping the engine, engine washing, overhauling the engine, etc. A problem with this approach is that many alerts are generated which are false and do not warrant further diagnostic or corrective actions. There are a number of reasons for the high number of false alerts being issued. One is that the data quality varies considerably between different engines. Another reason is that predetermined alert threshold levels for a variable are preset globally and not selected for an individual airplane. Other reasons for issuing an excessive number of alerts are noise generated from poorly calibrated and deteriorating sensors, the use of faulty data acquisition systems, and slow wear of the engine which results in a constant change of normal operating conditions.
If too many alerts are generated, then the aircraft engine expert has to constantly examine the trend charts to eliminate the false alerts from the true alerts. Constantly examining the trend charts becomes a very time consuming task when there is a large number of engines to monitor, as typically is the case for a large fleet of airplanes. In addition, the expert""s senses may become dulled to the true alerts due to the large amount of false positive alerts. Therefore, there is a need for a mechanism that alerts the expert of a truly suspicious situation, produces less false positive alerts and assists in reducing the excessive number of false alerts generated by a trend performance analysis tool without sacrificing the ability to detect true alerts.
This invention is able to find a truly suspicious situation by using abnormal condition detection along with a multi-dimensional approach to classify data. Abnormal condition detection does not try to classify an observation into particular faults. Rather, abnormal condition detection bins data into only two classes, xe2x80x9cnormalxe2x80x9d and xe2x80x9cabnormalxe2x80x9d. In this invention, an abnormal engine condition is detected by assessing data for several related engine variables and classifying the data as either normal or abnormal.
In order to assess the state of the engine, the data are evaluated to determine an alert level. In this evaluation, data for the related engine variables are examined on a multi-variate level to detect shifts. Generally, the more variables that are shifting at the same time, the more likely that there has been a suspicious change. A persistency checker increases a vigilance level as more suspicious data are encountered and decreases the level if normal data are encountered. The effect of the persistency checker is that alerts are not reported hastily. Rather the persistency checker requires a confirmation before increasing the level of alertness. Thus, outliers from both the normal class to the abnormal class and from the abnormal class to the normal class do not reset the alerting mechanism inadvertently. A composite alert score generator determines an alert score for each of the related engine variables based on the vigilance levels noted by the persistency checker. The composite alert score generator aggregates the alert scores for each of the related variables and then issues an alert when the vigilance level for the aggregate score surpasses a preset threshold.
In accordance with this invention, there is provided a system and a method for generating an alert from data obtained from a process. In this embodiment, a normalizer normalizes the data. A classifier classifies the normalized data in a multi-dimensional space defined for a plurality of variables in the process. The normalized data are classified into a normal class or an abnormal class defined in the multi-dimensional variable space. The normal class is indicative of normal operating conditions for the process and the abnormal class is indicative of potential alert conditions in the process. An alert level evaluator evaluates a vigilance level of the classified data for related variables. The alert level evaluator increases the vigilance level following a suspicious data reading classified in the abnormal class and decreases the vigilance level following a data reading classified in the normal class. An alert score generator generates an alert score for each of the related variables according to the vigilance level.
In accordance with another embodiment of this invention, there is provided a system and method for validating an alert generated from a trend performance analysis tool used to monitor data obtained from a process. In this embodiment, a normalizer normalizes the data monitored by the trend performance analysis tool. A classifier classifies the normalized data in a multi-dimensional space defined for a plurality of variables in the process. The normalized data are classified into-a normal-class or an abnormal class defined in the multi-dimensional variable space. The normal class is indicative of normal operating conditions for the process and the abnormal class is indicative of potential alert conditions in the process. An alert level evaluator evaluates a vigilance level of the classified data for related variables. The alert level evaluator increases the vigilance level following a suspicious data reading classified in the abnormal class and decreases the vigilance level following a data reading classified in the normal class. An alert score generator generates an alert score for each of the related variables according to the vigilance level. The alert generated from the trend performance analysis tool is valid if the alert score satisfies a predetermined score.